Add ExtractContainerIdFromCgroup method and update AddProcess to use it

microsoft · Jan 11, 2025 · 63689cd · 63689cd
1 parent 7c14deb
commit 63689cd
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 5 deletions.
diff --git a/ProcessTree.cpp b/ProcessTree.cpp
@@ -337,9 +337,8 @@ std::shared_ptr<ProcessTreeItem> ProcessTree::AddProcess(enum ProcessTreeSource
     std::string containerid = ExtractContainerId(exe, cmdline);         
     std::string cgroupContainerid;
 
-    if (containerid.empty()) {
-        auto p_temp = ReadProcEntry(pid);      
-        cgroupContainerid = p_temp->_cgroupContainerId;  
+    if (containerid.empty()) { 
+        cgroupContainerid = ExtractContainerIdFromCgroup(pid);
     } 
 
     auto it = _processes.find(pid);
@@ -651,6 +650,20 @@ void ProcessTree::SetContainerId(const std::shared_ptr<ProcessTreeItem>& p, cons
     }
 }
 
+std::string ProcessTree::ExtractContainerIdFromCgroup(const int pid)
+{
+    std::string containerid = "";
+    auto pinfo = ProcessInfo::OpenPid(pid, CMDLINE_SIZE_LIMIT);
+    if (!pinfo) {
+        Logger::Error("IB Failed to open proc entry for %d", pid);
+        return containerid;
+    }
+
+    containerid = pinfo->container_id();
+    Logger::Debug("IB (2) CGroup container id for %d is %s", pid, containerid.c_str());
+    return containerid;
+}
+
 std::string ProcessTree::ExtractContainerId(const std::string& exe, const std::string& cmdline)
 {
     // cmdline example: 

diff --git a/ProcessTree.h b/ProcessTree.h
@@ -224,14 +224,13 @@ class ProcessTree: public RunBase {
     std::shared_ptr<ProcessTreeItem> AddProcess(enum ProcessTreeSource source, int pid, int ppid, int uid, int gid, const std::string& exe, const std::string& cmdline);
     void Clean();
     std::shared_ptr<ProcessTreeItem> GetInfoForPid(int pid);
-    std::shared_ptr<ProcessTreeItem> ReadProcEntry(int pid);
 
     void PopulateTree();
     void UpdateFlags();
     void ShowTree();
     void ShowProcess(std::shared_ptr<ProcessTreeItem> p);
     static std::string ExtractContainerId(const std::string& exe, const std::string& cmdline);
-
+    std::string ExtractContainerIdFromCgroup(const int pid)
 
 protected:
     void on_stopping() override;
@@ -243,6 +242,7 @@ class ProcessTree: public RunBase {
     void RemovePid(int pid);
     void ApplyFlags(const std::shared_ptr<ProcessTreeItem>& process);
     void SetContainerId(const std::shared_ptr<ProcessTreeItem>& p, const std::string& containerid);
+    std::shared_ptr<ProcessTreeItem> ReadProcEntry(int pid);
 
     std::shared_ptr<UserDB> _user_db;
     std::shared_ptr<FiltersEngine> _filtersEngine;